【作者】 赵刚；

【导师】 乔佩利；

【作者基本信息】 哈尔滨理工大学 ， 计算机应用技术， 2005， 硕士

【摘要】 入侵检测系统是一种软件与硬件的结合,它通过分析网络或主机上发生的事件来发现其中的安全隐患。随着近几年网络攻击的事故频频出现,影响范围越来越广泛,入侵检测系统得到越来越多的重视,成为网络安全方案的重要组成部分。基于网络的入侵检测系统以网络数据作为原始的数据源,实时的分析网络上的通信。与基于主机的入侵检测相比,基于网络的入侵检测系统已经成为入侵检测的主流。但是随着网络带宽飞速增长,基于网络的入侵检测系统面临许多的困难。本文设计了一种高速网络环境下的网络入侵检测系统。该系统采用了新的设计,克服了以往系统在高速网络环境下面临的缺陷,提高了入侵检测的速度。本文用零拷贝的思想改进了传统的“抓包”方式;改进了传统的BM算法,结合AC 算法的思想提出了AC_BM 多模匹配算法来解决上层处理的瓶颈。改进的协议分析技术承接了上下两部分的工作,加快了检测的速度降低了误报率。同时对CVE 规则库的规则分析模块,提出了可行性方案。最后,本文对系统的性能进行了测试和分析,通过与传统系统的性能比较,证明该系统能够适应高速网络环境下入侵检测的要求。更多还原

【Abstract】 Intrusion detection systems (IDS) are software or hardware systems that automate the process of monitoring the events occurring in a computer system or network, analyzing them for signs of security problems. As network attacks have increased in number and severity over the past few years, intrusion detection systems have become a necessary addition to the security infrastructure of most organizations. Network-based intrusion detection systems (NIDS) uses raw network packets as the data source, and analyses all traffic in real-time as it travels across the network. Currently, IDS focuses on Network-based IDS, instead of Host-based IDS. NIDS has much difficulty with the rapid development of network bandwidth. This paper designs a network intrusion detection system for high-speed network. It implements some new designs so as to overcome faults of pass systems and detects attacks more accurately an efficiently. This page we improve the tradition packets acquisition procedure based on zero copy technology. To solve the bottleneck in the environment of high-speed network, we combine the thought of Boyer-Moore algorithm with that of Aho-Corasick algorithm, then we described a faster multi-pattern matching algorithm named AC_BM algorithm. Protocol analysis technology accepted two part’s work, and it greatly improves the performance of IDS and reduces the misapprehensive and transudatory rates. And then, we design a detection rules database based on Common Vulnerabilities and Exposures (CVE), and put forward a possibility’s project. Finally, this paper does some performance tests and analysis of system, and compares it with old system.更多还原